Remarks 

Claims 1-17 and 19-36 are currently pending. Reconsideration of the claims is 
respectfully requested. 

Claim 1-3, 7-11 and 13-14 were rejected under 35 U.S.C. 103(a) as being 
unpatentable over Abrahams (2005/0086090) in view of Bcverina (2001/0027389). 
Claims 4-6, 12 and 15-18 were rejected as being unpatentable over Abrahams and 
Beverina in view of Examiner's Official Notice that it is well known to measure negative 
impacts upon projects and to record minutes or topics discussed and the meeting date. 
Claims 19-20 were rejected as being unpatentable over Abrahams and Beverina in view 
of Heinrich US 6,895,383, which teaches an intranet for connecting workstations. Claims 
21-28 were rejected as being unpatentable over Abrahams, Beverina and Heinrich in 
view of Examiner s Official Notice that it is well known to measure negative impacts 
upon projects. 

In rejecting original claims 1 and 2, the Examiner cites to Abrahams' Table 1 as 
teaching a probability of occurrence table having a plurality of risk categories, each said 
category having table entries that include standardized qualitative probability definitions. 
The Examiner cites categories ranging from rare to almost certain. Applicant respectfully 
disagrees. Abrahams Table 1 describes a single generic risk category haying five entries. 
Each entry has a level (subjective value) from Rare to Almost Certain and associates 
values including typical, minimum and maximum. This one Table is subjectively applied 
by the user to all different categories of risk. By comparison, Applicant's probability of 
occurrence table as exemplified by Figures 6 and 9 and described at page 1 U lines 3-22 
and page 12, line 28 to page 13, line I and as recited in claim 1 as amended includes a 
plurality of risk categories, each category having a plurality of table entries, each entry 
including a category specific standardized qualitative probability definition associated 
with a Pf rating. The provision of multiple risk categories each having category-specific 
standardized qualitative definitions removes variability from the risk management 
process due to user subjectivity and replaces it with standardized definitions. The single 
generic table of Abrahams that relies on the subjective decision making of the user is the 
very approach Applicant's invention is target to replace and improve upon. This feature 
is not taught, suggested or motivated by Abrahams. 
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Furthermore, Para 0075 of Beverina says "the GUI 202 provides a web-like 
interface to the system...." Para 0117 again says that the "design provides a web-like 
interface." Para 0283 refers to "web like navigation..." Beverina's tool gives the 
impression that it is web based when, in fact, it is not. Claim 1 recites a "web-browser" 
not a "web-like browser". 

In rejecting original claim 3, the Examiner cites to Abrahams as teaching that a 
user can select inherent values of likelihood and consequence for a risk from Table 1 . 
The Applicant respectfully disagrees. First, as discussed above Table 1 is a generic table 
for a single generic risk category so it is not possible to tailor the table to remove risk 
categories. Secondly, selecting values of likelihood from fable I is not equivalent to 
tailoring the table. Furthermore, claim 3 as amended more clearly recites the method for 
tailoring the probability of occurrence table. Namely a user having administrative access 
not provided to the plurality of users tailors the probability of occurrence table to select a 
reduced number of risk categories that are relevant to the current development project 
and stores the tailored table on the shared risk database with access to said plurality of 
users (See Figures 5 and 6, p, 10, line 25 to page 11, line 22). The categories, 
standardized definitions and Pf ratings are in general project agnostic. The user with 
administrative access selects the applicable categories for the current projects. As such 
the Pf table is broadly applicable to many projects and can be custom tailored to (it 
particular projects, which is a considerable advantage. This feature is not taught, 
suggested or motivated by Abrahams. 

In rejecting original claim 4, the Examiner cites to Abrahams Table 2 as teaching 
that the severity of consequence table has a schedule impact category with the table 
entries having a cost impact category with the table entries specifying multiple sub- 
categories of cost impacts in actual dollars for the development project. The Examiner 
took Official Notice that it is old and well known in the art of project management to 
measure negati ve impacts upon projects like delays in units of time such as days, weeks 
or months. Applicant respectfully disagrees. First, Table 2 does not teach multiple sub- 
categories of cost impacts; the typical, minimum and maximum values are a range of 
dollar impacts for a single category, that category being the total aggregated impact. 
Second, although it may be well known in the art of project management such as used in 
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Microsoft Project, for example, to measure delays in days, weeks or months, it is not well 
known in the art of Risk assessment and management to do so. As shown in Applicant's 
Fig. 3, the standard approach is to assign a percentage (%) delay for the different entries 
so lhat the generic table can be used for any project without refinement 

Applicant has amended claims 2 and 4 to more specifically recite the novel 
elements of the invention as regards the severity of consequence Cf. As recited in claim 
2, the table includes cost and schedule impact categories, each category having a plurality 
of table entries, each entry including a standardized qualitative impact definition and a 
project-specific amount associated with a Cf rating (Fig. 7, p. 11, 23 to p. 12, 1. 8). The 
impact definitions are standardized whereas the amounts associated with the definitions 
and the Cf rating are project-specific. As with the probability of occurrence table this 
provides for general applicability to many different projects and customization to a 
current project. As recited in claim 4, the schedule impact entries specify a "project- 
specific" amount in days, weeks or months and the cost impact categories include 
multiple sub-categories of "project-specific' cost impacts in actual dollars. These 
features are not taught, suggested or motivated by Abrahams or the relevant art. 

In rejecting claim 5, the Examiner cites Abrahams paragraph [0007] that states 
"the inherent risk impact cost is aggregated over the inherent cost of each consequence of 
the risk". From Table 2 "each consequence of risk" refers to 'insignificant*, 'minor* etc. 
The inherent risk impact cost is aggregated over the different possible levels. The 
"insignificant", "minor" etc levels of risk arc not equivalent to sub-categories of risk at 
each level (or entry). More specifically, they are not equivalent to NRE, DTC and O/W 
categories. The ability to express the risk factor in project-specific actual dollar terms for 
these sub-categories is a very useful feature, not taught, suggested or motivated by 
Abrahams. 

Claim 6 has been amended to more specifically recite the method of tailoring the 
consequence Uible. A user having administrative access not provided to the plurality of 
users selects the cost impact sub-categories and specifies their dollar amounts and 
specifies the schedule impact for the current project. The tailored table is stored and then 
shared with the other users (See Figures 5 and 7, p. 10, line 25 to p. 11, line 2 and p. 11, 
line 23 to p. 12, line 8). The only 'tailoring* taught by Abrahams is for the individual 
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users to add new subject values and adjust typical values and associated ranges. 
Abrahams averages the input of all of the users to set new default values for the next time 
a user begins a project. There is no provision for an administrative user to tailor the 
consequence table in the manner claimed. 

Independent claims 15, 19 and 25 as amended include similar limitations to those 
presented and argued in the above claims. These limitations are not taught, suggested or 
motivated by Abrahams or the relevant art. 

New claims 29-32 as dependent from claim 1 and 34-36 as dependent from claim 
19 are directed to a method and system of formulating a mitigation search for the 
identified risk. The Examiner rejected the formulation of a risk mitigation search over 
Para [0307] that states "risk mitigation also uses threat and countermeasure 
characteristics in making decisions. Various countcrmcasures are compared to the 
specific threat to determine which ones are most effective at mitigating the risk of the 
threat against the target." The Beverina tool "stores information about actors (individuals 
and/or groups), physical surroundings, historical events and other information." The 
Beverina tool selects countermeasures to prevent terrorist attacks based on an evaluation 
of the risk of a terrorist attack, the vulnerability and assessment of expected damage. It is 
an expert system that already has preconceived scenarios using the existence of roads, car 
barriers, guard stations, hills, etc. It simulates the most probable route for aggressors and 
calculates the likelihood of threat success, or accessibility. It can re-run the simulation to 
determine the effectiveness of modified countcrmcasures. 

The new claims recite patentable features related to the formulation of a 
mitigation search and the development and execution of a mitigation plan not found in 
Beverina. In particular claims 28 and 34 are directed to formulating a mitigation search 
and formulating a new risk mitigation plan that builds upon the existing identified 
mitigation plans (p. 6, 1. 14 and p. 12, 1. 20-21). Beverina selects and than implements 
the countermeasure. Users in Beverina do not augment their own knowledge and 
expertise with the returned countermeasure to formulate a new countermeasure. Claims 
29 and 35 recite that the mitigation search identifies both successful and unsuccessful 
existing risk mitigation plans (p. 6, 1. 11-14). Beverina does not teach identifying 
unsuccessful countermeasures. Claim 30 recites aggregating the new risk mitigation 
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plans from a plurality of different users and different programs to update and store a risk 
mitigation plan for the risk (p. 5, 1. 14-15). Beverina does not teach this feature. Claims 
31 and 36 recite sharing resources with other programs to implement the mitigation plan 
(p. 14, 1. 6). Beverina does not teach this feature. Claim 32 recites tracking changes in 
the risk and revising the mitigation plan to address the changes (p. 15, 1. 13-15). Claim 
33 recites that the mitigation plan includes a number of activities, each activity including 
a description and an assigned Ff and Cf rating. Beverina does not teach this feature (p. 
14,1. 14-16). 
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Conclusion 

II is respectfully urged that the subject application is patentable over the cited 
references mid is now in condition for allowance. 

The Examiner is invited to call the undersigned at the below listed telephone 
number if, in the opinion of the Examiner, such a telephone conference would expedite or 
aid the prosecution and examination of this application. 



Noblitt & Gilmore, LCC 

Technology and Intellectual Property Law 

4800 North Scottsdale Road, Suite 6000 

Scottsdale, Arizona 

Tel 480 994-9888 




Eric A. Gilford fW 
Reg. No. 33,501 
520 760-1754 Phone 



Date: April 3, 2008 



ATTORNEY FOR APPLICANTS 
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